SCEP
com.apple.security.scep
The payload that configures Simple Certificate Enrollment Protocol (SCEP) settings.
Configuration Keys (1)
| Key | Type | Description | Default | Range |
|---|---|---|---|---|
| dict | A dictionary containing the SCEP information. | Default: — | Range: — | |
| string | The SCEP URL. See Over-the-Air Profile Delivery and Configuration for more information about SCEP. | Default: — | Range: — | |
NamestringName | string | A string that's understood by the SCEP server; for example, a domain name like example.org. If a certificate authority has multiple CA certificates, use this field to distinguish which is required. | Default: — | Range: — |
SubjectarraySubject | array | The representation of an X.500 name as an array of OID and value. For example, '/C=US/O=Apple Inc./CN=foo/1.2.5.3=bar' translates to '[ [ ["C", "US"] ], [ ["O", "Apple Inc."] ], …, [ [ "1.2.5.3", "bar" ] ] ]'. You can represent OIDs as dotted numbers, with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN). | Default: — | Range: — |
Array inside SCEP subject array | array | This array holds another array which holds an OID value pair | Default: — | Range: — |
SCEPSubjectArrayPairarraySubject array pair | array | An array representing an OID and value pair. | Default: — | Range: — |
SCEPSubjectArrayPairItemstringSCEP subject array pair item | string | One item in the array representing a pair of OID and value | Default: — | Range: — |
ChallengestringChallenge | string | A preshared secret. | Default: — | Range: — |
KeysizeintegerKey size | integer | The key size, in bits. | Default: 1024 | Range: 1024, 2048, 4096 |
CAFingerprintdataFingerprint | data | The fingerprint of the Certificate Authority certificate. | Default: — | Range: — |
Key TypestringKey type | string | Always 'RSA'. | Default: "RSA" | Range: RSA |
| integer | A bitmask indicating the use of the key. Possible values: '1': Signing '4': Encryption Some certificate authorities, such as Windows CA, support only encryption or signing, but not both at the same time. | Default: 0 | Range: None (0), Signing (1), Encryption (4), Both signing and encryption (5) | |
| boolean | If 'false', the system disables exporting the private key from the keychain. | Default: true | Range: — | |
SubjectAltNamedictSubject alt name | dict | The SCEP payload can specify an optional 'SubjectAltName' dictionary that provides values required by the CA for issuing a certificate. You can specify a single string or an array of strings for each key. The values you specify depend on the CA you're using, but might include DNS name, URL, or email values. For an example, see Sample Configuration Profile or Over-the-Air Profile Delivery and Configuration. | Default: — | Range: — |
rfc822NamestringRFC 822 name | string | The RFC 822 (email address) string. | Default: — | Range: — |
dNSNamestringDNS name | string | The DNS name. | Default: — | Range: — |
URI | string | The Uniform Resource Identifier. | Default: — | Range: — |
ntPrincipalNamestringNT principal name | string | The NT principal name. Use an other name OID set to '1.3.6.1.4.1.311.20.2.3'. | Default: — | Range: — |
| integer | The number of times the device should retry if the server sends a PENDING response. | Default: 3 | Range: — | |
| integer | The number of seconds to wait between subsequent retries. The device attempts the first retry without this delay. | Default: 10 | Range: — | |
Certificate Expiration Notification | integer | The number of days before the certificate expires at which to start showing the expiration notification | Default: 14 | Range: — |
| boolean | If 'true', all apps have access to the private key. | Default: false | Range: — |